Commit graph

217 commits

Author SHA1 Message Date
Bobby Rong 6ebfe7e1c2
webkitgtk: 2.38.4 → 2.38.5
https://webkitgtk.org/2023/02/15/webkitgtk2.38.5-released.html
https://webkitgtk.org/security/WSA-2023-0002.html

CVE-2023-23529
2023-02-17 22:03:48 +08:00
John Ericson b7e9a15ab9 webkitgtk: Add meta.pkgConfigModules and test 2023-02-13 10:21:07 -05:00
Jan Tojnar 9ae3781664 webkitgtk: 2.38.3 → 2.38.4
https://webkitgtk.org/2023/02/02/webkitgtk2.38.4-released.html
https://webkitgtk.org/security/WSA-2023-0001.html

CVE-2023-23517
CVE-2023-23518
CVE-2022-42826
2023-02-03 02:04:59 +01:00
Adam Joseph 42815b4a0c treewide: systemdSupport: use lib.meta.availableOn
Many packages have some kind of flag indicating whether or not to build with
systemd support.  Most of these default to `stdenv.isLinux`, but systemd does
not build on (and is marked `broken` for) `isStatic`.  Only a few packages have
the needed `&& !isStatic` in the default value for their parameter.

This commit moves the logic for the default value of these flags into
`systemd.meta.{platforms,badPlatforms}` and evaluates those conditions using
`lib.meta.availableOn`.

This provides three benefits:

1. The default values are set correctly (i.e. including `&& isStatic`)

2. The default values are set consistently

3. The way is paved for any future non-Linux systemd platforms (FreeBSD is
   reported to have experimental systemd support)
2023-01-22 00:27:19 -08:00
Weijia Wang a71bf0a118 webkitgtk: remove upstreamed darwin patches 2022-12-29 10:41:25 +01:00
Martin Weinelt 5880a6a2c8
webkitgtk: 2.38.2 -> 2.38.3
https://webkitgtk.org/2022/12/22/webkitgtk2.38.3-released.html
https://webkitgtk.org/security/WSA-2022-0011.html

Fixes: CVE-2022-42852, CVE-2022-42856, CVE-2022-42867, CVE-2022-46692,
       CVE-2022-46698, CVE-2022-46699, CVE-2022-46700
2022-12-26 20:05:06 +01:00
Jan Tojnar f930ba6aba webkitgtk: Bind NixOS directories to sandbox last
Since 31ac354cbe,
bubblewrap gets called the following way on NixOS system,
when it has `share/fonts` in `environment.pathsToLink`:

    $ bwrap --ro-bind /nix/store /nix/store --ro-bind /run/current-system /run/current-system --ro-bind-try /run/current-system/sw/share/fonts /run/current-system/sw/share/fonts -- $(realpath $(which true))
    bwrap: Can't mkdir parents for /run/current-system/sw/share/fonts: No such file or directory

It fails because `/run/current-system/sw` is a symlink
so bubblewrap is not be able to add another mountpoint inside.

Ideally, we would remove the `/run/current-system/sw` bind mount
and mount only specific subdirectories we need, like the fonts.
Unfortunately, it is not clear what else is needed. For example,
in the past, Pipewire’s Jack module was loaded from `/run/current-system/sw/lib`
756e60344f

So, for now, let’s keep the and mount and move the binding of NixOS directories
to the end. Adding bindings starting at leaves and moving to root should be fine.

While at it, let’s also make the binding of `/run/current-system` conditional
since it will not be available outside of NixOS.

Fixes: https://github.com/NixOS/nixpkgs/issues/197085
2022-11-14 19:47:10 +01:00
Brian McKenna 8c60992ea9 webkitgtk: unset separateDebugInfo for 32 bit platforms 2022-11-07 09:46:25 +01:00
Martin Weinelt 12c069cd35
webkitgtk: 2.38.1 -> 2.38.2
https://webkitgtk.org/2022/11/04/webkitgtk2.38.2-released.html
https://webkitgtk.org/security/WSA-2022-0010.html

Fixes: CVE-2022-32888, CVE-2022-32923, CVE-2022-42799, CVE-2022-42823
       CVE-2022-42824
2022-11-05 14:14:00 +01:00
Jan Tojnar 4e8b341ade webkitgtk: 2.38.0 → 2.38.1
https://webkitgtk.org/2022/10/20/webkitgtk2.38.1-released.html
https://github.com/WebKit/WebKit/compare/webkitgtk-2.38.0...webkitgtk-2.38.1

Changelog-Reviewed-By: Jan Tojnar <jtojnar@gmail.com>
2022-10-27 10:18:59 +02:00
Adam Joseph 946f7ba477
webkitgtk: set -DENABLE_JOURNALD_LOG=OFF if !systemdSupport
USE_SYSTEMD was replaced by ENABLE_JOURNALD_LOG:
f1ff3cc0f5

-- Could NOT find Journald (missing: Journald_LIBRARY Journald_INCLUDE_DIR)
CMake Error at Source/cmake/OptionsGTK.cmake:486 (message):
  libsystemd or libelogind are needed for ENABLE_JOURNALD_LOG
Call Stack (most recent call first):
  Source/cmake/WebKitCommon.cmake:220 (include)
  CMakeLists.txt:20 (include)

-- Configuring incomplete, errors occurred!
See also "/build/webkitgtk-2.36.0/build/CMakeFiles/CMakeOutput.log".
See also "/build/webkitgtk-2.36.0/build/CMakeFiles/CMakeError.log".
2022-10-06 11:25:38 +08:00
Jan Tojnar 225103487a webkitgtk: 2.37.90 → 2.38.0
https://webkitgtk.org/2022/09/16/webkitgtk2.38.0-released.html
https://github.com/WebKit/WebKit/compare/webkitgtk-2.37.90...webkitgtk-2.38.0
https://webkitgtk.org/security/WSA-2022-0009.html

Fixes:
CVE-2022-32886
CVE-2022-32891
CVE-2022-32912

Changelog-Reviewed-By: Jan Tojnar <jtojnar@gmail.com>
2022-09-20 19:35:24 +02:00
Jan Tojnar 57e596a865 webkitgtk: Display ABI version in name
To make it easier to distinguish which versions are in the closure.
2022-09-20 19:35:24 +02:00
Jan Tojnar ccc127b3da webkitgtk: 2.37.1 → 2.37.90
https://webkitgtk.org/2022/08/19/webkitgtk2.37.90-released.html
https://github.com/WebKit/WebKit/compare/webkitgtk-2.37.1...webkitgtk-2.37.90

Changelog-Reviewed-By: Jan Tojnar <jtojnar@gmail.com>
2022-09-20 19:35:24 +02:00
Jan Tojnar f5d6f8b560 webkitgtk: 2.36.7 → 2.37.1
https://webkitgtk.org/2022/07/12/webkitgtk2.37.1-released.html

Changelog-Reviewed-By: Jan Tojnar <jtojnar@gmail.com>
2022-09-20 19:35:24 +02:00
Jan Tojnar b66c75e1e8 webkitgtk_5_0: init 2022-09-20 19:35:24 +02:00
Martin Weinelt cb40cdf49a
webkitgtk: 2.36.6 -> 2.36.7
https://webkitgtk.org/2022/08/24/webkitgtk2.36.7-released.html
https://webkitgtk.org/security/WSA-2022-0008.html

Fixes: CVE-2022-32893
2022-08-30 00:09:04 +02:00
Simon Bruder 12d647d5c8
webkitgtk: 2.36.5 -> 2.36.6
Fixes #185219.
2022-08-10 21:58:07 +02:00
Jan Tojnar a06ac1c36a webkitgtk: 2.36.4 → 2.36.5
https://webkitgtk.org/2022/07/28/webkitgtk2.36.5-released.html
https://webkitgtk.org/security/WSA-2022-0007.html
2022-07-29 00:04:35 +02:00
Jan Tojnar a238ca2853 webkitgtk: 2.36.3 → 2.36.4
https://webkitgtk.org/2022/07/05/webkitgtk2.36.4-released.html
https://webkitgtk.org/security/WSA-2022-0006.html
2022-07-05 14:54:38 +02:00
Martin Weinelt 21879444fa webkitgtk: 2.36.2 -> 2.36.3
https://webkitgtk.org/2022/05/28/webkitgtk2.36.3-released.html
https://webkitgtk.org/security/WSA-2022-0005.html

Fixes: CVE-2022-26700, CVE-2022-26709, CVE-2022-26717, CVE-2022-26716,
       CVE-2022-26719, CVE-2022-30293, CVE-2022-30294
2022-06-01 18:47:28 +02:00
Jan Tojnar 158386e5a3 webkitgtk: re-enable WPE_RENDERER
Build with WPE renderer is no longer tested upstream
https://bugs.webkit.org/show_bug.cgi?id=238513#c10
and that configuration is extremely buggy since 2.36.0:
https://github.com/NixOS/nixpkgs/issues/169201

Previously it was disabled in c0d053ea0e.
2022-05-19 07:19:13 +02:00
Jan Tojnar aefa8f6546 webkitgtk: 2.36.1 → 2.36.2
https://webkitgtk.org/2022/05/18/webkitgtk2.36.2-released.html
2022-05-19 07:19:13 +02:00
Jan Tojnar 7487afc36f webkitgtk: 2.36.0 → 2.36.1
https://webkitgtk.org/2022/04/21/webkitgtk2.36.1-released.html
2022-04-29 14:36:31 +02:00
Jan Tojnar 75eb096778 webkitgtk: 2.34.6 → 2.36.0
https://webkitgtk.org/2022/03/21/webkitgtk2.36.0-released.html
2022-04-08 22:27:32 +02:00
Adam Joseph 43f8a58df8 webkitgtk: honor systemdSupport
This commit exposes support for compilation without systemd,
controlled by the global systemdSupport argument.  This argument is
understood by many other nixpkgs expressions and can be set globally
in ~/.config/nixpkgs/config.nix.
2022-02-26 15:48:02 -08:00
zseri bed1ee0548 webkitgtk: make it easier to disable avahi globally by fixing enableGeoLocation option
The problem with enableGeoLocation was that it didn't compose well with
.overrideAttrs and setting geoclue2=null at the overlay level
because of the assert statement.

Thus, when combined with disabling libsecret, the resulting override code was:
  avahi = null;
  geoclue2 = { outPath = throw "geoclue is disabled"; };
  webkitgtk = prev.lib.pipe prev.webkitgtk [
    (x: x.override { enableGeoLocation = false; geoclue2 = prev.geoclue2; })
    (x: x.overrideAttrs (old: { cmakeFlags = old.cmakeFlags ++ [ "-DUSE_LIBSECRET=OFF" ]; }))
    (x: x.override { enableGeoLocation = false; geoclue2 = null; libsecret = null; })
  ];

It works, but is unnecessarily complex.

: detailed motviation
libsecret and geoclue2 are actually completely independent,
the real conflict is between assert and override/overrideAttrs which
don't work as expected; e.g. you can pass an updated parameter, but the
original parameter at callPackage "calltime" after recusion through overlays
gets used, so when globally setting "geoclue2=null;" in an overlay,
the assert is always hit without any way to work around that
2022-02-23 23:38:05 +01:00
Martin Weinelt cf6944227c
webkitgtk: 2.34.5 -> 2.34.6
https://webkitgtk.org/security/WSA-2022-0003.html

Fixes: CVE-2022-22620
2022-02-18 01:16:31 +01:00
R. Ryantm 641899248d webkitgtk: 2.34.4 -> 2.34.5
https://webkitgtk.org/2022/02/09/webkitgtk2.34.5-released.html
https://webkitgtk.org/security/WSA-2022-0002.html

Fixes: CVE-2022-22589, CVE-2022-22590, CVE-2022-22592
2022-02-09 15:11:44 +01:00
Martin Weinelt a574ff9929
webkitgtk: 2.34.3 -> 2.34.4
https://webkitgtk.org/security/WSA-2022-0001.html
2022-01-22 00:16:04 +01:00
Philipp f6cd576e45 webkitgtk: 2.34.2 -> 2.34.3 2021-12-22 02:22:03 +01:00
R. Ryantm e3ebd4e356 webkitgtk: 2.34.1 -> 2.34.2 2021-12-22 02:21:21 +01:00
Kerstin Humm bb799694db
epoxy: rename to libepoxy
https://github.com/NixOS/nixpkgs/issues/145040
2021-11-11 05:55:32 +01:00
Dmitry Kalinkin c983d3e37e
webkitgtk: mark as broken on darwin 2021-11-08 16:17:56 -05:00
Jan Tojnar 17547192a4 webkitgtk: 2.34.0 → 2.34.1
https://webkitgtk.org/2021/10/21/webkitgtk2.34.1-released.html
2021-10-24 16:24:29 +02:00
Jan Tojnar 21b1744593 webkitgtk: 2.32.3 → 2.34.0
Changes:
- https://webkitgtk.org/2021/05/14/webkitgtk2.33.1-released.html
- https://webkitgtk.org/2021/06/08/webkitgtk2.33.2-released.html
- https://webkitgtk.org/2021/08/16/webkitgtk2.33.3-released.html
- https://webkitgtk.org/2021/09/02/webkitgtk2.33.90-released.html
- https://webkitgtk.org/2021/09/17/webkitgtk2.33.91-released.html
- https://webkitgtk.org/2021/09/22/webkitgtk2.34.0-released.html

Notably, libsoup3 is used by default. We revert that to reduce breakage
so programs using libsoup 3.x will need to override the argument.
2021-10-09 21:35:52 +02:00
ajs124 7e7a4021e8 webkitgtk: 2.32.3 -> 2.32.4
https://webkitgtk.org/security/WSA-2021-0005.html
2021-09-21 00:28:12 +02:00
Robert Hensing fbafeb7ad5 treewide: runCommandNoCC -> runCommand
This has been synonymous for ~5y.
2021-08-15 17:36:41 +02:00
Angus Trau 44b130d392 webkitgtk: remove reference to private Apple SDK 2021-08-10 14:59:05 +09:00
sternenseemann 9f9a4c2aed webkitgtk: removed now merged patch on darwin 2021-08-07 12:39:50 +02:00
Philipp Bartsch 3bb38198e9 webkitgtk: 2.32.1 -> 2.32.3
Relevant security advisory:
https://webkitgtk.org/security/WSA-2021-0004.html

CVEs:
CVE-2021-1817,  CVE-2021-1820,  CVE-2021-1825,  CVE-2021-1826,
CVE-2021-21775, CVE-2021-21779, CVE-2021-21806, CVE-2021-30661,
CVE-2021-30663, CVE-2021-30665, CVE-2021-30666, CVE-2021-30682,
CVE-2021-30689, CVE-2021-30720, CVE-2021-30734, CVE-2021-30744,
CVE-2021-30749, CVE-2021-30758, CVE-2021-30761, CVE-2021-30762,
CVE-2021-30795, CVE-2021-30797, CVE-2021-30799
2021-07-23 20:57:02 +02:00
Dmitry Kalinkin 61e49ba58b
webkitgtk: fix on darwin 2021-05-23 01:26:33 -04:00
Vladimír Čunát 8a0c5da648
Merge #122333: webkitgtk: Fix bubblewrap opengl-driver path 2021-05-12 12:53:16 +02:00
Vladimír Čunát a7833724fd
webkitgtk: 2.32.0 -> 2.32.1
https://webkitgtk.org/2021/05/10/webkitgtk2.32.1-released.html
In particular, we now needed to fix the build with icu-69.
2021-05-11 22:13:36 +02:00
talyz 5926b95fbe
webkitgtk: Fix bubblewrap opengl-driver path
If `/run/opengl-driver/lib` is in `LD_LIBRARY_PATH`, bwrap will try to
mount it into the already bind mounted `/run/opengl-driver`. To
prevent this, we instead specify the subpaths of `/run/opengl-driver`
we're interested in.

Also, use the correct path for i686 builds.
2021-05-10 13:05:48 +02:00
Jan Tojnar 702d3e2794
webkitgtk: Try to fix build on Darwin
- Libmanette and systemd features need to be disabled since they depend on systemd.
- FastMalloc for some reason does not include <malloc/malloc.h> so we added that.
- <CommonCrypto/CommonRandom.h> depends on a type from <CommonCrypto/CommonCryptor.h> but does not include it for some reason, resulting in the following error:

	In file included from ../Source/WTF/wtf/RandomDevice.cpp:44:
	/nix/store/wd30p2pq4lci8fk9fqldkgk1hgmwpapj-Libsystem-1238.60.2/include/CommonCrypto/CommonRandom.h:35:9: error: unknown type name 'CCCryptorStatus'
	typedef CCCryptorStatus CCRNGStatus;

- The GL-related flags were renamed and removed (in previous releases as well) so we switched to the new ones so that GL is still disabled.
- Unrelatedly, `with` statement at the top of the expression is abomination so we narrowed its scope to just meta.
2021-05-05 22:43:07 +02:00
Vladimír Čunát b0dae10ba7
qt5.qtwebengine, webkitgtk: try harder to avoid timeouts
I hope this will improve the situation on aarch64-linux.
I don't think it could make anything worse.
Recent staging-next timeouts:
https://hydra.nixos.org/build/141551270
https://hydra.nixos.org/build/141547098

For now let's not touch meta.timeout, as there's less consensus and the
setting seems less reliable in practice, too.
2021-04-19 13:21:48 +02:00
Gabriel Ebner dfefa8e328 webkitgtk: add mesa dependency 2021-04-09 18:12:15 +02:00
Martin Weinelt 9086bb9b78
webkitgtk: 2.30.6 -> 2.32.0
https://webkitgtk.org/security/WSA-2021-0003.html

https://webkitgtk.org/2021/03/26/webkitgtk2.32.0-released.html

Fixes: CVE-2021-1788, CVE-2021-1844, CVE-2021-1871
2021-03-30 01:01:32 +02:00
Martin Weinelt 75f531b3fc
webkitgtk: 2.30.5 -> 2.30.6
https://webkitgtk.org/security/WSA-2021-0002.html
2021-03-27 14:22:41 +01:00